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AMENDMENTS TO THE CLAIMS: 

This listing of claims will replace all prior versions, and listings, of claims in the 
application: 

LISTING OF CLAIMS 

1 . (Currently Amended) A method for correlating a first sensor to a second sensor 
in an intrusion detection system, the first sensor and the second s e nsors sensor each 
maintaining belief ov e r a numb e r of poss i bl e stat e s of regarding a resource or service 
monitored by the intrusion detection system, the method comprising the steps of: 

(a) transmitting to the first sensor information about th e s e cond sensor's a 
belief state of the second sensor said belief state of the second sensor indicating a 
state of at least one system resource or service directly monitored by the second 
sensor; and 

(b) adjusting a pfief belief state of the first sensor, said belief state of the first 
sensor indicating a state of at least one system resource or service directly monitored 
by the first sensor, the a djustm e nt adjusting based at least in part on the s e cond 
s e nsor's belief state of the second sensor, so that a sensitivity of the first sensor to 
suspicious activity in the intrusion detection system is improved . 

2. (Currently Amended) The method of claim 1 wherein the first sensor and the 
second s e nsors sensor are different types of sensors. 

3. (Original) The method of claim 2 wherein the first sensor is a probabilistic 
sensor. 

4. (Currently Amended) A method for reducing false alarms generated by an 
intrusion detection system when a monitored resource is degraded or compromised, the 
intrusion detection system having a first sensor and a second s e nsors sensor each 
maintaining belief ov e r a numb e r of possib le stat e s of regarding a state of a resource 
monitored by the intrusion detection system, the method comprising the steps of: 

(a) transmitting to the first sensor all or part of the a belief of the second 
sensor regarding an apparent normal, degraded or compromised state of a resource 
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directly monitored by the second sensor; and 

(b) adjusting a pfier belief state of the first senso r, said belief state of the first 
sensor indicating r e garding an apparent normal, degraded or compromised state of a 
resource directly monitored by the firsts so that an erroneous transaction with the 
degraded or compromised resource does not generate an alarm in the intrusion 
detection system . 

5. (Currently Amended) A method for enhancing the a sensitivity of an intrusion 
detection system that monitors a plurality of computer system resources, the intrusion 
detection system having a first sensor and a second s e nsors sensor each maintaining 
belief ov e r a numb e r of poss i b le stat e s of regarding a service monitored by the intrusion 
detection system, the method comprising the steps of: 

(a) transmitting to the first sensor all or part of the a belief state of the second 
sensor regarding the an existence or validity of services supported on computer system 
resources directly monitored by the second sensor; and 

(b) adjusting a prief belief state of the first senso r, said belief state of the first 
sensor indicating r e gard i ng the an existence or validity of services supported on 
computer system resources directly monitored by the first sensor so that an attempted 
communication with a nonexistent system service or resource appears suspicious to the 
intrusion detection system . 

6. - 9. (Cancelled) 

10. (Currently Amended) A computer readable storage medium containing an 
executable program for correlating a first sensor to a second sensor in an intrusion 
detection system, the first sensor and the second s e nsors sensor each maintaining 
belief ov e r a numb e r of poss i b le stat e s of regarding a resource or service monitored by 
the intrusion detection system, where the program performs the steps of: 

(a) transmitting to the first sensor information about th e s e cond s e nsor's a 
belief state of the second sensor , said belief state of the second sensor indicating a 
state of at least one system resource or service directly monitored by the second 
sensor; and 
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(b) adjusting a prior belief state of the first sensor, said belief state of the first 
sensor indicating a state of at least one system resource or service directly monitored 
by the first sensor, the adjustm e nt adjusting based at least in part on the s e cond 
s e nsor's belief state of the second sensor, so that a sensitivity of the first sensor to 
suspicious activity in the intrusion detection system is improved . 

11. (Currently Amended) A computer readable storage medium containing an 
executable program for reducing false alarms generated by an intrusion detection 
system when a monitored resource is degraded or compromised, the intrusion detection 
system having a first sensor and a second s e nsors sensor each maintaining belief ovef 
a numb e r of poss i b le stat e s of regarding a state of a resource monitored by of the 
intrusion detection system, where the program performs the steps of: 

(a) transmitting to the first sensor all or part of the a belief of the second 
sensor regarding an apparent normal, degraded or compromised state of a resource 
directly monitored by the second sensor; and 

(b) adjusting a prior belief state of the first senso r, said belief state of the first 
sensor indicating regard i ng an apparent normal, degraded or compromised state of a 
resource directly monitored by the first sensor so that an erroneous transaction with the 
degraded or compromised resource does not generate an alarm in the intrusion 
detection system . 

12. (Currently Amended) A computer readable storage medium containing an 
executable program for enhancing the a sensitivity of an intrusion detection system that 
monitors a plurality of computer system resources, the intrusion detection system 
having a first sensor and a second s e nsors sensor each maintaining belief ov e r a 
number of poss i b le states of regarding a service monitored bv the intrusion detection 
system, where the program performs the steps of: 

(a) transmitting to the first sensor all or part of the a belief state of the second 
sensor regarding the an existence or validity of services supported on computer system 
resources directly monitored by the second sensor; and 

(b) adjusting a prior belief state of the first senso r, said belief state of the first 
sensor indicating r e gard i ng tho an existence or validity of services supported on 
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computer system resources directly monitored by the first sensor so that an attempted 
communication with a nonexistent system service or resource appears suspicious to the 
intrusion detection system . 

13. (Cancelled) 
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